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ABSTRACT: 

In accordance with a first aspect of the present invention, a security sensitive program that 
operates with a secret is made tamper resistant by distributing the secret in space as well as In 
time. In accordance with a second aspect of the present invention, a security sensitive program Is 
made tamper resistant by obfuscating the program. In accordance with a third aspect of the 
present invention, a security sensitive application is made tamper resistant by isolating its security 
sensitive functions, and making the isolated security sensitive functions tamper resistant by 
distributing the secrets of the security sensitive functions in time as well as in space, and/or 
obfuscating the security sensitive functions. In one embodiment where obfuscation Is employed, 
the pseudo-randomly selected pattern(s) of mutations is (are) unique for each installation. In 
accordance with a fourth aspect of the present invention, a security sensitive system with security 
sensitive applications is made further tamper resistant by deploying an interlocking trust 
mechanism. In accordance with a fifth aspect of the present invention, a content industry 
association, in conjunction with content manufacturers, content reader manufacturers, and 
content player manufacturers of the industry jointly implement a coordinated 
encryption/decryption scheme, with the player apparatus manufactured by the content player 
manufacturers employing playing software that include tamper resistant decryption functions. 
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(54) TlUe: TAMPER RESISTANT METHODS AND APPARATUS 
(57) Abstract 

In accordance with a first aspea of the present invention, 
a security sensitive program (100) that operates with a secret 
(lot) is made tamper resistant by distributing the secret in 
space as well as in time. In accordance with a second aspect 
of the present invention, a security sensitive program is made 
tamper resistant by obfuscating the program. In accordance 
with a third aspect of the present invention, a security sensitive 
application is made tamper resistant by isolating its security 
sensitive functions, and malcing the isolated security sensitive 
functions tamper resistant by distributing ttie secrets of the 
security sensitive functions in time as well as in space, 
and/or obfuscating the security sensitive functions. In one 
embodiment where obfuscation is employed, the pseudo- 
randomly selected pattem(s) of mutations is (are) unique for 
each installation. In accordance with a fouith aspect of the 
present invention, a security sensitive system with security 
sensitive £q)piications is made further tamper resistant by 
deploying an interiocking trust mechanism. In accordance 
widi a fifth aspect of die present invention, a content industry 
association, in conjunction with content manufacturers, content 
reader manufacturers, and content player manufacturers of the 
industry jointly implement a coordinated encryption/decryption 
scheme, with the player apparams manufacmred by the content 
player manufacturers employing playing software that include 
tamper resistant decryption functions. 
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Tamp r Resistant M th ds And Apparatus 

^A^nKr.um JND of T HE INVENTION 
5 1. Fi^M Invention 

The present invention relates to the field of system security. More 
specifically, the present invention relates to the tamper resistant methods and 
apparatus. 

10 

2. Background Infonnation 

Many applications, e.g. financial transactions, unattended authorizations 
and content management, require the basic integrity of their operations to be 

15 assumed, or at least verified. While a number of security approaches such as 

encryption and decryption techniques are known in the art, unfortunately, the security 
approaches can be readily compromised, because these applications and the 
security approaches are implemented on systems with an open and accessible 
architecture, that renders both hardware and software including the security 

20 approaches observable and modifiable by a malevolent user or a malicious program. 

Thus, a system based on open and accessible architecture is a 
fundamentally insecure platform, notwithstanding the employment of security 
measures. However, openness and accessibility offer a number of advantages, 
25 contributing to these systems' successes. Therefore, what is required are techniques 
that will render software execution virtually unobservable or unmodlfiable on these 
fundamentally insecure platforms, notwithstanding their openness and accessibility. 
As will be disclosed in more detail below, the present invention of tamper resistant 
methods and apparatus achieve these and other desirable results. 

3d 

SUMMARY OF THE INVENTION 

In accordance with a first aspect of the present invention, a security 
sensitiv program that operat s with a secret is mad tamper resistant by distributing 
35 the secret in space as well as in time. The secret is partitioned into a number of 

subparts, and the security sensitive program is unrolled into a number of subprograms 
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that operate with the subparts, one subpart per subprogram. The subprograms are 
then executed over a period of time. In one embodiment, the subprograms are further 
interleaved with unrelated tasks. In one application, the security sensitive program is 
a decryption program and the secret is a private key. 

In accordance with a second aspect of the present invention, a security 
sensitive program is made tamper resistant by obfuscating the program. The security 
sensitive program is divided into a number of subprograms, and a plaintext 
appearance location schedule is selected for the subprograms. An appropriate 

10 mutated initial state is detemiined for each of the subprograms, except for the 

subprogram where the program's entry point is located. The mutated initial states are 
determined based on one or more pseudo-randomly selected patterns of mutations 
that return the program to the initial state at the end of an execution pass. During 
execution, the subprograms are recovered when they are needed, one or more but 

15 not all at a time, following the pseudo-randomly selected pattem(s) of mutations. In 
one embodiment, each pseudo-randomly selected pattern of mutations is detemiined 
using a predetermined partnership function in conjunction with an ordered set of 
pseudo-random keys. In one application, the security sensitive program is a 
decryption program that operates with a secret private key. The decryption program 

20 may or may not have been made tamper resistant by distributing the secret private key 
in time as well as in space. 

In accordance with a third aspect of the present invention, a security 
sensitive application is made tamper resistant by isolating its security sensitive 

25 functions, and making the isolated security sensitive functions tamper resistant by 
distributing the secrets of the security sensitive functions in time as well as in space, 
and/or obfuscating the security sensitive functions. In one embodiment where 
obfuscation is employed, the pseudo-randomly selected pattem(s) of mutations is 
(are) unique for each installation. In one applrcation, the application is a content 

30 management application having a decryption function. 

In accordance with a fourth aspect of the present invention, a security 
sensitive system with security sensitive applications is made further tamper resistant 
by providing a system integrity verification program having tamper resistant integrity 
35 verification k mels, that jointly deploy an interiocking trust mechanism with th tamper 
resistant security sensitive functions of the security sensitive applications. In one 
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3 , . 

application, the system is a cont nt manipulation system, and the application .s a 
content management application. 

In accordance with a fifth aspect of the present invention, a content 
industry association, in conjunction with content manufacturers, content reader 
manufacturers, and content player manufacturers of the industo^ jointly implement a 
coordinated encryption/deciyption scheme, with the player apparatus manufactured 
by the content player manufacturers employing playing software that include tamper 
resistant decryption functions. 

PniFF rFg'"R'PT|n|M OF nRAWINGS 

The present invention will be described by way of embodiments, but not 
limitations, illustrated in the accompanying drawings in which like references denote 

15 similar elements, and in which: 

Figure 1 is a block diagram illustrating a first aspect of the present 
invention for making a security sensitive program tamper resistant by distributing the 
program's secret(s) in time and in space: 

Figure 2 is a block diagram illustrating one embodiment of the first 
20 aspect of the present invention including a subprogram generator for generating the 
subprograms that operate with conresponding subparts of the distributed secret(s); 

Figure 3 is a flow diagram illustrating one embodiment of the 
operational flow of the subprogram generator of Figure 2; 

Figure 4 is a block diagram illustrating a second aspect of the present 
25 invention for making a security sensitive program tamper resistant by obfuscating the 
various subparts of the security sensitive program; 

Figure 5 is a block diagram illustrating one embodiment of a subpart of 

the obfuscated program; 

Figure 6 is a block diagram illustrating one embodiment of the second 
30 aspect of the present invention including an obfuscation processor for generating the 

obfuscated program; 

Figure 7 is a graphical diagram illustrating distribution of key penod for 

the second aspect of the present invention; 

Figures 8a - 8b are flow diagrams illustrating one embodiment of the 
35 operational flow of the obfuscation processor of Figure 6; 
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FIgur 9 is a flow diagram illustrating one embodiment of the 
operational logic of an obfuscated subprogram of the obfuscated program; 

Figures 10 - 14 are diagrams illustrating a sample application of the 

second aspect of the present invention; 
5 Figure 15 is a block diagram illustrating a third aspect of the present 

invention for making a security sensitive application tamper resistant; 

Figure 16 is a block diagram illustrating a fourth aspect of the present 
invention for making a security sensitive system tamper resistant; 

Figure 17 is a block diagram illustrating a fifth aspect of the present 
10 invention for making security sensitive industry tamper resistant; and 

Figures 18 - 19 are block diagrams illustrating an example computer 
system and an embedded controller suitable for programming with the various 
aspects of the present invention. 

15 pFTAii FD DEg nRiPTlQN OF THE INVENTION 

In the following description, various aspects of the present invention will 
be described. However, it will be apparent to those skilled in the art that the present 
invention may be practiced wfth only some or all aspects of the present invention. For 
20 purposes of explanation, specifk: numbers, materials and configurations are set forth in 
order to provide a thorough understanding of the present invention. However, it will 
also be apparent to one skilled in the art that the present invention may be practiced 
without the specific details. In other instances, well known features are omitted or 
simplified in order not to obscure the present invention. 

25 

Parts of the description will be presented in tenms of operatrans perfomied 
by a computer system, using terms such as data, flags, bits, values, characters, strings, 
numbers and the like, consistent with the manner commonly employed by those skilled 
in the art to convey the substance of their worit to others skilled in the art. As well 

30 understood by those skilled in the art. these quantities take the form of electrical, 
magnetic, or optical signals capable of being stored, transferred, combined, and 
otherwise manipulated through mechanical and electrical components of the computer 
system; and the tenn computer system include general purpose as well as special 
purpose data processing machines, systems, and the like, that are standalone, adjunct 

35 or embedded. 
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Various operations will be described as multiple discrete steps in turn in a 
manner that is most helpful in understanding the present Invention, however, the order 
of description should not be construed as to imply that these operations are necessanly 
order dependent, in particular, the order of presentation. 

^ Referring now to Figure 1. a block diagram illustrating a first aspect of 

the present invention is shown. In accordance with this first aspect of the present 
invention, security sensitive program 100 is made tamper resistant by distributing its 
secret in space as well as in time. The secret (not shown in totality) Is "partitioned 

10 into subparts 101. and program 100 is unrolled into a number of subprograms 102 
that operate with subparts 101; for the illustrated embodiment, one subpart 101 per 
subprogram 102. Subprograms 102 are then executed over a period of time. Asa 
result, the complete secret cannot be obsen/ed or modified in any single point in 
space nor in any single point in time. 

For example, consider the artificially simple "security sensitive" program 
for computing the result of X multiply by S, where S is the secret. Assuming S equals 
to 8, S can be divided into 4 subparts, with each subpart equals 2. and the "security 
sensitive" program can be unrolled Into 4 subprograms with each program computing 
20 A = A + (X multiply by 2). Thus, the complete secret 8 can never be observed or 
modified in any point In space nor time. 

As a further example, consider the "security sensitive" program for 
computing the result of (X to the power of S) modulo Y, where S again is the secret. 
25 If S equals 16, S can be divided into 8 subparts, with each subpart equals 2. and the 
"security sensitive" program can be unrolled into 8 subprograms with each program 
computing A = (A multiply by ((X to the power of 2) modulo Y)) modulo Y. Thus, the 
complete secret 16 can never be observed or modified in any point in space nor time. 

30 As will be appreciated by those skilled in the art, the function (X to the 

power of S) modulo Y is the basis function employed in many asymmetric key 
(private/public key) schemes for encryption and decryption. Thus, by practicing this 
first aspect of the present invention, an encryption/decryption function can be made 
tamper resistant. 

35 
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In one embodiment, th subprograms are further interleaved with 
unrelated tasks to further obscure the true nature of the tasks being performed by the 
unrolled subprograms. The tasks may even have no purpose to them. 

5 Figure 2 illustrates one embodiment of the first aspect of the present 

invention including a subprogram generator for generating the subprograms. For the 
Illustrated embodiment, subprogram generator 104 is provided with the secret as 
Input. Furthermore, subprogram generator 104 is provided with access to library 105 
having entry, basis and prologue subprograms 106. 108, and 109 for used in 

1 0 generating subprograms 1 02 of a particular security sensitive program in view of the 
secret provided. In other words, entry and basis subprograms 106 and 108 
employed are different for different security sensitive programs. For the above 
illustrated examples, in the first case, entry and basis subprograms 106 and 108 will 
initialize and compute A = A + (X multiply by a subpart of S), whereas in the second 

15 case, entry and basis subprograms 106 and 108 will initialize and compute A = (A 
multiply by ((X to the power of a subpart of S) modulo Y)) modulo Y. Prologue 
subprogram 109 is used to perfomi post processing, e.g. outputting the computed 
results as decrypted content. 

20 For the illustrated embodiment, entry subprogram 106 is used in 

particular to initialize an appropriate runtime table 110 for looking up basis values by 
basis subprogram 108, and basis subprogram 108 is used to perfomi the basis 
computation using runtime table 110. For the modulo function example discussed 
above, runtime table 110 is used to retum basis values for (X to the power of a 

25 subpart of secret) modulo Y for various subpart values, and basis subprogram 108 is 
used to perform the basis computation of A = (A multiply by (basis value of a subpart 
of secret)) modulo Y, where A equals the accumulated intemnediate results. A's initial 
value is 1 . 

30 For example, entry subprogram 106 may initialize a aintime table 110 

of size three for storing the basis values of bvl , bv2 and bv3, where bv1 , bv2 and bv3 
equal (X to the power of 1) modulo Y, (X to the power of 2) modulo Y, and (X to the 
power of 3) modulo Y respectively. For the modulo function (X to the power 5) modulo 
Y, subprogram generator 104 may partition the secret 5 into two subparts with 

35 subpart values 3 and 2, and generate two basis programs 108 computing A = (A * 
Lkup(3)) modulo Y and A = (A * Lkup(2)) modulo Y respectively. 
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Figure 3 illustrates one embodiment of the operational flow of 
subprogram generator 104 of Figure 2. For the illustrated embodiment, upon 
invocation, subprogram generator 104 first generates an instance of entry 

5 subprogram 106 for initializing at least an appropriate runtime lookup table 110 
(Lkup) for returning the basis values of a modulo function for various subparts of a 
secret and an accumulation variable (A) to an appropriate initial state, step 112. 
Subprogram generator 104 then partitions the secret into subparts, step 114. In one 
embodiment, the partition is perfomied to require the least number of basis programs, 

10 within the constraint of the basts values stored in mntime table 110. 

Next, subprogram generator 104 sets a subpart of the secret as the 
lookup index (LIDX). steps 116. Then, subprogram generator 104 generates the 
current basis subprogram to compute A = [A muttlply by Lkup (LIDX)] modulo Y. step 
15 118 Subprogram generator 104 repeats steps 116 -118 for all subparts, until a 

basis program has been generated for each subpart of the secret, step 120. Finally, 
subprogram generator 104 generates an instance of prologue subprogram 109 for 
perfonning post processing, as described eariier, step 122. 

20 Figure 4 illustrates a second aspect of the present invention. In 

accordance with this second aspect of the present invention, security sensitive 
program 203 is made tamper resistant by obfuscating the program. Security sensitive 
program 203 is divided and processed into a number of obfuscated subprograms 
204. A plaintext (i.e. unmutated) appearance location schedule (i.e. where in 

25 memory) is selected for obfuscated subprograms 204. For the illustrated 

embodiment, the plaintext appearance location schedule is formulated in terms of the 
memory cells 202 of two memory segments, memory segment 201a and memory 
segment 201b. Initially, except for the obfuscated subprogram 204 where the 
program's entry point is located, all other obfuscated subprograms 204 are stored in 

30 mutated states. Obfuscated subprograms 204 are recovered or made to appear in 
plaintext form at the desired memory cells 202. one or more at a time, when they are 
needed for execution, and mutated again, once executions are completed. As will be 
described in more detail below, the initial mutated states, and the process of recoveiy 
are determined or perfomied. in accordance with one or more pseudo-randomly 

35 selected pattern of mutations. The ps udo-randomly sel cted pattem(s) of mutations 
is (are) determined using a predetemnined mutation partnership function in 
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conjunction with one or more ord red sets of pseudo-random keys. As a result, 
obfuscated subprograms 204 cyclically mutate back to their respective initial states 
after each execution pass. Actually, obfuscated subprograms 204 implementing the 
same loop also cyclically mutate back to the loop entry states after each pass through 
5 the loop. 

For the illustrated embodiment, each obfuscated subprogram 204 and 
each cell 202 are of the same size, and first memory segment 201a Is located in h.gh 
memory, whereas second memory segment 201b is located in low memory. 
10 Furthemiore. there are even number of obfuscated subprograms 204. employing 
dummy subprogram if necessary. 

Figure 5 illustrated one embodiment of subprogram 204. In 
accordance with the present invention, for the illustrated embodiment, in addition to 
1 5 original subprogram 102, obfuscated subprogram 204 Is provided with mutation 
partner identification function 206. mutation function 207. partner key 208 and jump 
block 209. Original subprogram 102 perfomis a portion of the functions performed 
by program 200. Original subprogram 102 may be an entry/basls/prologue 
subprogram 106/108/109 in accordance with the first aspect of the present 
20 Invention. Mutation partner Identification function 206 is used to identify the partner 
memory cells 202 for all memory cell 202 at each mutation round. In one 
embodiment, the partner identification function 206 is the function: Partner Cell ID = 
Cell ID XOR Pseudo-Random Key. For a pseudo-random key. mutation partner 
identification function 206 will identify a memory cell 202 in the second memory 
25 segment 201 b as the partner memory cell for of a memory cell 202 in the first 

memory segment 201a, and vice versa. Only ordered sets of pseudo-random keys 
that will provide the required periods for the program and Its loops will be employed. 
The length of a period is a function of the pseudo-random keys" set size (also refen-ed 
to as key length). Mutation function 207 is used to mutate the content of the various 
30 memory cells 202. In one embodiment, mutation function 207 XORs the content of 
each memory cell 202 in firet memory segment 201a into the partner memory cell 
202 in second memory segment 201b in an odd mutation round, and XORS the 
content of each memory cell 202 in second memory segment 201b into the partner 
memory cell 202 In first memory segment 201a in an even mutation round. Partner 
35 key 208 is the pseudo-random key to be used by mutation partner identificatran 
function 206 to identify mutation partners of the various memory cells 202 for a 
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mutation round. Jump block 209 transfers^execution control to the next obfuscated 
subprogram 204, which at the time of transfer, has been recovered into plaintext 
through the pseudo-random pattern of mutations. 

5 In one embodiment, an obfuscated subprogram 204 may also include 

other functions being performed for other purposes or simply unrelated functions 
being performed to further obscure the subpart functions being perfom^ed. 

Figure 6 illustrates one embodiment of the second aspect of the 
10 present invention including an obfuscation processor for processing and transfomning 

subprograms into obfuscated subprograms. For the illustrated embodiment. 

obfuscation processor 214 is provided with program 200 as inputs. Furthemriore. 

obfuscation processor 214 is provided with access to pseudo-random keys' key 

length lookup table 212. mutation partner identification function 206. and mutation 
15 function 207. For the illustrated embodiment, obfuscation processor 214 also uses 

two working matrices 213 during generation of obfuscated program 203. 

Key length lookup table 212 provides obfuscation processor 214 with 
key lengths that provide the required periods by the program and its loops. Key 
20 lengths that will provide the required periods is a function of the mutation technique 
and the partnership function. Figure 7 illustrates various key lengths that will provide 
various periods for the first and second memory segment mutation technique and the 
partnership function described above. 

25 Referring back to Figure 6, mutation partner identification function 206 

identifies a mutation partner memory cell 202 for each memory cell 202. In one 
embodiment, mutation partner identification function 206 identifies mutation partner 
memory cells in accordance with the "XOR" mutation partner identification function 
described eariier. Mutation function 207 mutates all memory cells 202. In one 

30 embodiment, mutation function 207 mutates memory cells 202 in accordance with 
the two memory segments, odd and even round technique described eariier. 

For the illustrated embodiment, wort<ing matrices 213 include two 
matrices Ml and M2. Woricing matrix Ml stores the Boolean functions of the current 
35 state of the various memory cells 202 in terms of the initial valu s of memory cells 
202. Wori<lng matrix M2 stores the Boolean functions for recov ring the plaintext of 
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the various obfuscated subprograms 204 lifterms of the initial values of memory cells 
202. 



Referring now to Figures 8a - 8b. two block diagrams illustrating one 
5 embodiment of obfuscation processor 214 are shown. For the illustrated 

embodiment, as shown in Fig. 8a in response to a program input (in obiect fomi). 

obfuscation processor 214 analyzes the program, step 216. In particular. 

obfuscation processor 214 analyzes branch flow of the program, identifying loops 

within the program, using conventional compiler optimization techniques known in the 
10 art. For the purpose of this application, any execuHon control transfer, such as a call 

and subsequent return, is also considered a "loop". 

Next, obfuscation processor 214 may perfomn an optional step of 
peephole randomization, step 218. During this step, a peephole randomization pass 
15 over the program and replaces code patterns with random equivalent patterns chosen 
fmm an optional dictionary of such patterns. Whether it is perfomied depends on 
whether the machine architecture of the instructions provide alternate ways of 
accomplishing the same task. 

20 Then, obfuscation processor 214 restmctures and partitions the 

program 200 into a number of equal size subprograms 204 organized by their loop 
levels, padding the subprograms 204 if necessary, based on the analysis results, 
step 220. Except for very simple program with a single execution path, virtually all 
programs 200 will require some amount of restmcturing. Restructuring includes e.g. 

25 removing as well as adding branches, and replicating instructions in different loop 
levels. Restmcturing is also perfomied using conventional compiler optimization 
techniques. 

Finally, obfuscation processor 214 detemfiines the subprograms' 
30 plaintext appearance location schedule, and the initial state values for the various 
memory cells 202, step 221. 

Fig. 8b illustrates step 221 in further detail. As shown, obfuscation 
processor 214 first Initializes first worthing matrix Ml, step 222. Then, obfuscation 
35 processor 21 4 selects a memory cell for the program's entry subprogram to appear in 
plaintext, step 223. In one embodiment, the memory cell 202 is arbitrarily selected 



wo 97/48203 



PCT/US97/10359 



(within the proper memory segment 201a Jr 201b). Once selected, obfuscation 
processor 214 updates the second working matrix M2. step 224. 

Next obfuscation processor 21 4 selects an appropriate key length 
5 based on the procedure's period requirement, accessing key length table ^12 step 
226 Obfuscln processor 214 then generates an ordered set of pseudo-random 

Sys based on the selected key length, step 228. For example, if key length equals 5 
is selected among the key lengths that will provide a required penod of 30. 
obfutln p Jssor 214 may randomly select 17. 18. 20. 24 and 16 as the o^lered 
10 pseudo-random keys. 

Next obfuscation processor 214 detemiines the partner memory cells 
202 for all memoir cells 202 using the predetem^ined mutation partner identification 
function 206 and the next key in the selected set of ordered pseudo-random keys. 
15 step 230. Upon making the determination, obfuscation processor 214 simulates a 
mutation, and updates f^1 to reflect the results of the mutation, step 232. 

Once mutated, obfuscation processor 214 selects a memory cell for the 
next subprogram 204 to appear in plaintext, step 234. Having done so. obfuscation 

20 processor 214 updates K/I2. and incrementally Invert M2 using the Guassian Method, 
step 235 In one embodiment, instead of Incremental inverston, obfuscation 
processor 214 may just verify M2 remains invertable instead. If M2 is not invertable. 
obfuscation processor 214 cancels the memory cell selection, and restores M2 to its 
prior state, step 237. Obfuscation processor 214 repeats steps 234 - 236 to select 

25 another memory cell 202. Eventually, obfuscation processor 214 becomes 
successful. 

Once succeeded, obfuscation processor 21 4 determines if there was a 
loop level change, step 238. If there was a loop level change, obfuscation processor 

30 214 further detemiines if the loop level change is down level or up level change, i.e. 
the subprogram is an entry subprogram of a new loop level or a return point of a 
higher loop level, step 239. If the loop level change is "down", obfuscation processor 
214 selects another appropriate key length based on the new loop's penod 
requirement, accessing key length table 212. step 241. Obfuscation processor 214 

35 then generates a new ordered set of ps udo-random keys based on the newly 

sel cted key length, step 242. The newly generated ordered set of pseudo-random 
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12 

keys becomes the "top" set of pseudo-random keys. On the other hand, if the loop 
level change id "up", obfuscation processor 214 restores an immediately "lower" set 
of pseudo random keys to be the "top" set of pseudo-random keys, step 240. 

Upon properly organizing the "top" set of pseudo-random keys or upon 
determining there's no loop level change, obfuscation processor 214 again 
detemiines the partner memory cells 202 for all memory cells 202 using the 
predetemiined mutation partner identification function 206 and the next key in the 
•top" set of ordered pseudo-random keys, step 243. Upon making the detemiination. 
obfuscation processor 214 simulates a mutation, and updates M1 to reflect the results 
of the mutation, step 244. 



Once mutated, obfuscation processor 214 determines if there are more 
subprograms 204 to process, step 245. If there are more subprograms 204 to 

15 process, obfuscation processor 214 returns to step 234 and proceeds as described 
earlier. Othenwise, obfuscation processor 214 inserts the mutation partner 
identification function 206. the partner key to be used to identify mutation partner 
memory cells, the mutation function, the jump block, and the address of the next 
subprogram 204 into each of the obfuscated subprograms 204, step 246. Finally. 

20 obfuscation processor 21 4 computes the initial values of the various obfuscated 
subprograms 204, and outputs them, steps 247 - 248. 

Figure 9 illustrates one embodiment of the operational flow of an 
obfuscated subprogram 204. For the illustrated embodiment, obfuscated subprogram 

25 204 first executes the functions of the original subprogram, step 250. For 

embodiments including additional and/or unrelated functions, they may be executed 
also. Then obfuscated subprogram 204 executes mutation partner identification 
function 206 to identify the mutation memory cell partners for all memory cells 202 
using the stored partner key. step 252. Having identified the mutation partners, 

30 obfuscated subprogram 204 executes mutation function 207 to mutate the mem?'y 
cells based on the identified partnership. 

Next, depending on whether obfuscated subprogram 204 is the last 
subprogram in an execution pass, obfuscated subprogram 204 either jumps to the 
35 next obfuscated subprogram (which should be in plaintext) or returns to the "caller". 
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Note that if obfuscated subprogram 204 ^Ls to the "caller-, all other obfuscated 
subprograms 204 are in their respective initial states. 

Figures 10 - 14 illustrate a sample application of this second aspect of 
5 the present invention. Figure 10 illustrates a sample security sensitive program 200 
having six subprog^ms SPGMO - SPGM5 a simp^^^^^^^^ 

for ease of explanation, with contrived plaintext values of ■'GOO". 001 01 0 0 1 _ 
"100" and -1ir. Thus, the required period is 6. For ease of explanation, a keylength 
of one will be used, and the pseudo-random key selected is 3. Furthermore^ the 
10 mutation partnership identification function is simply Partner Cell ID = Cell ID h- 3. i.e. 
cell 0 always pairs v^ith cell 3. cell 1 pairs with cell 4. and cell 2 pairs v^rth cell 5. 

Figure 10 further illustrates at invocation (mutation 0). memory cells (cO 
- c5) contains initial values (ivO - iv5). as reflected by M1 . Assuming, cell cO is chosen 
15 for SPGMO. M2 is updated to reflect that the Boolean function for recovenng the 
plaintext of SPGMO is simply ivO. Figure 10 further illustrates the values stored .n 
memory cells (cO - c5) after the first mutation. Note that for the illustrated mutation 



20 



memory ceil » - w/ " 

technique, only the content of the memory cells (c3 - c5) have changed. Ml is 
updated to reflect the current state. Assuming, cell c3 Is chosen for SPGM1 . M2 is 
updated to reflect that the Boolean function for recovering the plaintext of SPGM1 is 
simply ivO XOR iv3; Note that for convenience of manipulation, the columns of M2 



have been swapped. 



Figure 11 illustrates the values stored in memory cells (cO - c5) after 
25 the second, third and fourth mutations. As shown, the content of half of the memory 
cells (CO - c5) changed altematingly after each mutation. In each case. Ml is updated 
to reflect the current state. Assuming, cells c1 . c4 and c2 are chosen for SPGM2. 
SPGM3 and SPGM4 respectively after the second, third and fourth mutations 
respectively, in each case M2 is updated to reflect that the Boolean functions for 
30 recovering the plaintexts of SPGM2. SPGM3 and SPGM4. i.e. iv4. iv1 , and .v2 XOR 
iv5. 

Figure 12 illustrates the values stored in memory cells (cO - c5) after 
the fifth mutation. As shown, the content of memory cells (c3 - c5) changed as in 
35 previous odd rounds of mutation. Ml is updated to reflect the current state. 
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Assuming, cell c5 Is chosen for SPGM5, M2 is updated to reflect that the Boolean 
function for recovering the plaintext of SPGM5 is iv5. 

Figure 13 Illustrates how the initial values ivO - iv5 are calculated from 
5 the inverse of m, since M2 x ivs = SPGMs. ivs = M2-1 x SPGMs. Note that a "V in 
M2-1 denotes the corresponding SPGM is selected, whereas a "0" in M2-1 denotes 
the corresponding SPGM is not selected, for computing the initial values (ivO - iv5). 

Figure 14 illustrates the content of the memory cells of the above 
10 example during execution. Note that at any point in time, at most only two of the 

subprograms are obsen/able in their plaintext forms. Note that the pairing of mutation 
partners is fixed only because of the single pseudo-random key and the simple 
mutation partner function employed, for ease of explanation. Note also that with 
- another mutation, the content of the memory cells are back to their initial states. In 
15 other words, after each execution pass, the subprograms are in their initial states, 
ready for another invocation. 

As will be appreciated by those skilled in the art, the above example is 
unrealistically simple for the purpose of explanation. The plaintext of a subprogram 
20 contains many more "0" and "1" bits, making it virtually impossible to distinguish 

memory cell storing an obfuscated subprogram in a mutated state from a memory cell 
storing an obfuscated subprogram in plaintext form. Thus. It is virtually impossible to 
i^nfer the plaintext appearance location schedule from obsen/ing the mutations during 
execution. 

25 

Figure 15 illustrates a third aspect of the present invention. In 
accordance with this aspect of the present invention, security sensitive application 
300 may be made tamper resistant by isolating its security sensitive functions 302 
and making them tamper proof by incorporating the first and/or second aspects of the 
30 present invention described above. 

In employing the above described second aspect of the present 
invention, different sets of pseudo-random keys will produce a different pattem of 
mutations, even with the same mutation partner identification function. Thus, copies of 
35 the security sensitive application installed on different systems may b made unique 
by employing a different pattem of mutations through different sets of pseudo-random 
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keys Thus, the security sensitive applicatio^ns Installed in different systems are further 
resistant from class attack, even if the obfuscation scheme is understood from 
observation on one system. 

Figure 16 Illustrates a fourth aspect of the present Invention. In 
accordance with this aspect of the present invention, a security sensitive system ^0 
may be made tamper resistant by making its security sensitive appl.cat.ons 400a and 
400b tamper resistant in accordance with the first, second and/or third aspects of the 
present invention described above. Furthemiore. security of system 400 may be 
further strengthened by providing system integrity verification program (SIVP) 404 
having a number of integrity verification kernels (IVKs). Forthe "'"Strated 
embodiment, a first and a second level IVK 406a and 406b. First level IVK 406a 
has a published external interface for other tamper resistant security sensitive 
functions (SSFs) 402a - 402b of the security sensitive applications 400a - 400b to 
call Both IVKs are made tamper resistant in accordance with the first and the second 
aspects of the present invention described eariier. Together, the tamper resistant 
SSFs 402a - 402b and IVKs 406a - 406b implement an interiocking trust 
mechanism. 

In accordance with the interlocking trust mechanism, forthe illustrated 
embodiment, tamper resistant SSF1 and SSF2 402a - 402b are responsible for the 
integrity of security sensitive applications 400a ■ 400b respectively. IVK1 and IVK2 
406a - 406b are responsible for the integrity of SIVP 404. Upon verifying the 
integrity of security sensitive application 400a or 400b it Is responsible for. 
SSF1/SSF2 402a - 402b will call IVK1 406a. In response, IVK1 406a will verify 
the integrity of SIVP 404. Upon successfully doing so, IVK1 406a calls IVK2 406b. 
which in response, will also verify the integrity of SIVP 404. 

Thus, in order to tamper wHh security sensitive application 400a. SSF1 
402a. IVK1 406a and IVK2 406b must be tamper with at the same time. However, 
because IVK1 and IVK2 406a - 406b are also used by SSF2 and any other SSFs 
on the system, all other SSFs must be tamper with at the same time. 

Figure 17 illustrates a fifth aspect of the present invention. In 
accordance with this aspect of the pres nt invention, content Industry association 
500. content manufactur rs 502, content reader manufacturers 510 and content 
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player manufacturer 506 may jointly implement a coordinated encryption/decryption 
scheme with content players 508 manufactured by content player manufacturers 
506 employing playing software that include content decryption function made 
tamper resistant in accordance with the above described various aspects of the 
5 present invention. 

Content industry association 500 owns and holds secret private 
encryption key Kciapri. Content industry association 500 encrypts content 
manufacturer's secret content encryption key Kc and content player manufacturer's 
10 public encryption Kppub for the respective manufacturers 502 and 506 us.ng Kc.apn. 
i.e. Kciapri[Kc] and Kciapri[Kppubl. 

Content manufacturer 502 encrypts its content product Kc[ctnt] and 
includes with the content product Kciapri[Kc]. Content reader manufacturer 510 
15 includes with its content reader product 512 the public key of content rndustry 
association Kclapub. whereas content player manufacturer 506 includes wrth tts 
content player product 508 content player manufacturer's secret private play key 
Kppri. content industry association's public key Kciapub. and the encrypted content 
player public key Kciapri[Kppub]. 

During operatksn, content reader product 512 reads encrypted content 
Kclctnt] and the encrypted content encryption key Kciapri[Kc]. Content reader product 
512 decrypts Kc using Kciapub. Concurrently, content player product 508 recovers 
its public key Kppub by decrypting KciaprilKppub] using content industry association's 

25 public key Kciapub. Content reader product 512 and content player product 508 are 
also in communication with each other. Upon recovering its own public key. content 
player product 508 provides it to content reader product 512. Content reader product 
512 uses th© provided player public key Kppub to encrypt the recovered content 
encryption key Kc. generating Kppub[Kc], which is retumed to content player product 

30 508. In response, content player product 508 recovers content encrypt key Kc by 
decrypting KppubtKc] using its own private key Kppri. 

Thus, as content reader product 512 reads encrypted content Kc[ctntl, 
and fonwards them to content player product 508. content player product 508 
35 decrypts them with th recovered Kc, gen rating the unencrypted content (ctnt). In 
accordance with the above described aspects of the pr sent invention, the decryption 
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functions for recovering the content playeJs^manufacturer's public key. and 
recovering the content encryption key Kc are made tamper resistant. 

AS will be appreciated by those skilled in the art. in addition to being 
5 made tamper resistant, by virtue of the interlocldng tmst. tampering with the content 
^ay^^^^^^^^^^ decryption functions will require tampering of the content .ndustn. 
association content manufacturer and content reader manufacturer's 
Tn^decrypti^^ functions, thus making It virtually impossible to cor.prom.se the 
various enciyption/deciyptlon functions' integnty. 

AS will be also appreciated by those skilled in the art. a manufacturer 
mav Dlav more than one role in the above described tamper resistant industry secunty 
::;errg mlfacturing both the content reader and the content player products, 
as separate or combined products. 

Figure 18 illustrates a sample computer system suitable to be 
programmed with security sensitive programs/applications with or without SIVP^ 
Luding industry wise security mechanism, made tamper res.stant .n accordance 
with the first, second, third, fourth and/or fifth aspect of the present invention. Sample 

20 n system 600 includes CPU 602 and cache memory 604 couple to each 
other through processor bus 605. Sample computer system 600 also includes h^h 
perfom^ance I/O bus 608 and standard bus 618. Processor bus 605 and high 
performance 1/0 bus 608 are bridged by host bridge 606. whereas high performance 
i/O bus 608 and standard I/O bus 618 are bridged by bus bridge 610. Coupled to 

25 high perfomiance I/O bus 608 are main memory 612. and video mernory 614^ 
Coupled to video memory 614 is video display 616. Coupled to standard I/O bus 
618 are mass storage 620. and keyboard and pointing devices 622. 

These elements perform their conventional functions. In particular, mass 
30 storage 620 is used to provide pemianent storage for the executable Instructions of 
the various tamper resistant programs/applications, whereas main memory 612 is 
used to temporarily store the executable instructions tamper resistant 
programs/applications during execution by CPU 602. 

35 Figur 19 illustrates a sample emb dded controller suitable to be 

programmed with security sensitive programs for a security sensitive apparatus, made 
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tamper resistant in accordance with the first, second, third, fourth and/or fifth aspect of 
the present invention. Sample embedded system 700 includes CPU 702, main 
memory 704, ROM 706 and I/O controller 708 coupled to each other through system 
bus 710. These elements also pertonm their conventional functions. In particular, 
5 ROM 706 may be used to provide permanent and execute-in-place storage for the 
executable instructions of the various tamper resistant programs, whereas main 
memory 704 may used to provide temporary storage for various wort<ing data during 
execution of the executable instructions of the tamper resistant programs by CPU 
702. 

10 

Thus, various tamper resistant methods and apparatus have been 
described. While the methods and apparatus of the present invention have been 
described in terms of the above illustrated embodiments, those skilled in the art will 
recognize that the invention is not limited to the embodiments described. The present 
15 invention can be practiced with modification and alteration within the spirit and scope 
of the appended claims. The description is thus to be regarded as illustrative instead 
of restrictive on the present invention. 
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What is claimed is: 



1. An apparatus comprising: 

an execution unit for executing programming instructions: and 
a storage medium coupled to the execution unit, having stored therein a 
plurality of programming instruction blocks to be executed by the execution unit dunng 
operation, the programming instrucHon blocks operating on con-esponding subparts of 
a secret distributed among them, and the execution being distributed over a penod of 



time. 
2 



The apparatus as set forth in claim 1 . wherein the programming instruction 
blocks jointly implement a decryption function, and the secret is a private key. 

3 The apparatus as set forth in claim 1 , wherein one or more of the programming 
iristruction blocks further perfomi one or more unrelated tasks to further obscure the 
operations on the subparts of the secret. 

4. A machine implemented method for executing a program that operates on a 
secret in a tamper resistant manner, the method comprises the steps of: 

a) executing a first unrolled subprogram of the program at a first point a time, 
with the first unrolled subprogram operating on a first subpart of the secret; and 

b) executing a second unrolled subprogram of the program at a second point a 
time, with the second unrolled subprogram operating on a second subpart of the 
secret. 

5. The method as set forth in claim 3. wherein the first and second unrolled 
subprograms are unrolled subprograms of a decryption function; and the secret is a 
private key. 

6. The method as set forth in claim 3, wherein 

step (a) further includes the first unrolled subprogram perfomiing at least a first 

unrelated task; and 

step (b) further includes the second unrolled subprogram perfonning at least a 
second unrelated task; 
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said at least a first and a second unrelated task are performed to further 
obscure the first and second unrolled subprograms' operation on the first and second 
subparts of the secret. 

7. An apparatus comprising: 

an execution unit for executing programming instructions; and 
a storage medium having stored therein a plurality of programming instructions 
to be executed by the execution unit during operation, wherein when executed, in 
response to a secret being provided, the programming instructions partition the secret 
into a plurality of subparts, and generate a plurality of programming instruction blocks 
that operate on the subparts. 

8. The apparatus as set forth in claim 7, wherein the apparatus further includes a 
library having an entry programming instruction block, and a basis programming 
instruction block, to be accessed by the programming instructions in generating the 
programming instruction blocks. 

9. The apparatus as set forth in claim 7, wherein during execution. 

the entry programming instruction block initializes a table of values for use by 
the basis programming blocks to operate on their corresponding subparts of the 
secret; and 

the basis programming blocks' operations on their corresponding subparts of 
the secret, include looking up values initialized in the table using the basis 
programming blocks' con-esponding subparts of the secret. 

10. A machine implemented method for generating a tamper resistant program to 
operate on a secret, the method comprising the steps of: 

a) receiving the secret; 

b) partitioning the secret into a plurality of subparts; and 

c) generating a plurality of subprograms to con^espondingly operate on the 
subparts of the secret. 

11. The method as set forth in claim 1 0, wherein step (c) includes accessing a 
library having an entry subprogram, and a basis subprogram to generate the 
subprograms. 
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12 The method as set forth in claim 11. wherein during execution. 

the entry subprogram initializes a table of values for use by the basis 
subprograms to operate on their corresponding subparts of the secret; and 

the basis subprograms' operations on their corresponding subparts of the 
secret, include looking up values initialized in the table using the basis subprograms 
corresponding subparts of the secret. 

13 An apparatus comprising: 

an execution unit for executing programming instructions; and 

a storage medium having stored thereon a plurality of programming instmction 
blocks to be executed by the execution unit, the programming instmction blocks being 
stored in a mutated fom,. except for at least one. which is stored in a plaintext omri. 
wherein the mutated programming instmction blocks are recovered into the plaintext 
form during execution on an as needed basis, one or more but not all at a time. 

14 The apparatus as set forth in claim 13. wherein each programming instruction 
block includes a first programming instruction sub-block for performing a task, a 
second programming instruction sub-block for computing mutation partners for a 
plurality of memory cells, a key to be employed in said computation of mutation 
partners, a third programming instruction sub-block for mutating memory cells in 
accordance with the computed mutation partnering, and a fourth programming 
instmction sub-block for transferring execution control to another programming 
instruction block. 

1 5. The apparatus as set forth In claim 14, wherein the first programming 
instmction sub-block operates on a subpart of a secret. 

1 6. The apparatus as set forth in claim 14, wherein the second programming 
instmction sub-block computes the mutation partnering by performing a logical XOR 
operation on a memory cell's identifier and the key. 

1 7. The apparatus as set forth in claim 14, wherein the key is a member of an 
ordered set of pseudo-randomly selected members, the ordered set having a set size 
that will provide a required period for a pattern of memory cell mutations, with the 
memory cells being partnered for mutation in accordance with the computed mutation 
partnering using the key. 
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18. The apparatus as set forth in claim 1 4. wherein the memory cells are divided 
into two memory cells groups, and pair-wise partnered by the second programming 
instruction sub-block, with the partnered memory cells being in different group; and 
the third programming instmction sub-block perfomis a logical XOR operation on the 
contents of each pair of partnered memory cells, and alternating between the two 
memory ceil groups for odd and even mutation rounds, in storing the results of the 
logical XOR operations 

19. A machine implemented method for executing a program, the method 
comprising: 

a) executing a first of a plurality of subprograms generated to obfuscate the 
program; 

b) computing mutation partners for a plurality of memory cells stonng the 
plurality of subprograms, using a key. the subprograms being stored initially in the 
memory cells in a mutated fomi. except for at least one. which is stored initially in a 
plaintext fomn; 

c) mutating the memory cells in accordance with the computed mutation 
partnering to recover a second of the plurality of subprograms for execution. 

20. The method as set forth in claim 19, wherein the first and second subprograms 
operate on a first and a second subpart of a secret. 

21. The method as set forth in claim 19. wherein step (b) comprises perfomiing a 
logical XOR operation on a memory cell's identifier and the key for each memory cell. 

22. The method as set forth in claim 19. wherein the key is a member of an ordered 
set of pseudo-randomly selected members, the ordered set having a set size that will 
provide a required period for a pattern of memory cell mutations, with the memory 
cells being partnered for mutation in accordance with the computed mutation 
partnering using the key. 

23. The method as set forth in claim 19, wherein step (c) comprises performing 
logical XOR operations on the contents of memory cells of a first memory cell group 
and the contents of memory cells of a second memory cell group, and storing the 
results of the logical XOR operations into the first memory cell group if step (c) is being 
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performed for an odd number of times, and the second memory cell group if step (c) is 
being performed for an even number of times. 

24 The method as set forth in claim 1 9. wherein the method further comprises the 
5 steps of: 

d) executing the second of the plurality of subprograms; 

e) computing mutation partners for the plurality of memory cells; and 

f) mutating the memory cells in accordance with the computed mutation 
partnering to mutate thefirst of the plurality of subprograms, and recover a third of the 

10 plurality of subprograms for execution. 

25. An apparatus comprising: 

an execution unit for executing programming instructions; and 
a storage medium having stored therein a first plurality of programming 
15 instructions to be executed by the execution unit, wherein when executed, .n 

response to a program input, the first plurality of programming Instmctions generate a 
plurality of subprograms for the program to obfuscate the program, the subprograms 
being generated in a mutated fomi. except for at least one. which is generated in a 
plaintext form, the subprograms being further generated with logic to recover the 
20 subprograms in plaintext form on an as needed basis, one or more but not all at a 



time. 



26. The apparatus as set forth in claim 25, wherein the storage medium further 
having stored therein a table of keylengths to be accessed by the first plurality of 

25 programming instructions in generating the subprograms, the keylengths denoting 
sizes of ordered sets of pseudo-randomly selected members that will provide vanous 
required mutation periods. 

27. The apparatus as set forth in claim 25, wherein the storage medium further 
30 having stored therein a second plurality of programming instnictions to be 

incorporated into each of the generated subprograms by the first plurality of 
programming instructions for identifying mutation partners for a plurality of memory 
cells storing the subprograms, for a mutation round, using a key. the key being a 
member of an ordered set of pseudo-randomly selected members that will provide a 
35 mutation period required by the gen rated subprograms. 
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28. The apparatus as set forth in claim 25. wherein the storage medium further 
having stored therein a second plurality of programming instmctlons to be 
incorporated into each of the generated subprograms by the first plurality of 
programming instmctlons for mutating memory cells storing the generated 

5 subprograms in accordance with computed mutation partnerings for a mutation round. 

29. The apparatus as set forth In claim 25, wherein the first plurality of 
programming instnjctions include logic for analyzing the program for branch flow. 

10 30. The apparatus as set forth in claim 25, wherein the first plurality of 

programming instmctions include logic for performing peephole randomization on the 
program. 

31 . The apparatus as set forth in claim 25, wherein the first plurality of 

15 programming instmctions include restmcturing and partitioning the program into the 
subprograms. 

32. The apparatus as set forth in claim 25, wherein the first plurality of 
programming instmctions include logic for scheduling memory cells for the generated 

20 subprograms to be recovered in the plaintext form, and determining the appropriate 
initial values for the memory cells. 

33. The apparatus as set forth in claim 32, wherein the first plurality of 
programming instructions include logic for detennining a mutation period requirement 

25 for the program, a keylength for the required mutation period, the keylength denoting 
a set's set size, the set being an ordered set of pseudo-randomly selected members 
that will provide the required mutation period. 

34. The apparatus as set forth in claim 32, wherein the first plurality of 

30 programming instructions include logic for selecting a memory cell for a generated 
subprogram to be recovered in the plaintext form, and determining a Boolean function 
for recovering the generated subprogram in the plaintext fonn in temns of inrtial state 
values of the memory cells used for storing the generated subprograms. 

35 35. The apparatus as set forth in claim 32, wh rein the first plurality of 

programming instructions include logic for detemnining mutation partners for a 
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plurality of memory cells storing the generated subprograms, using a key o an 
ordered set of pseudo-randomly selected keys, simulating memory cell mutations .n 
accordance with the detemiined mutation partnering, and detemiining a plurality of 
Boolean functions for the memoir cells, the Boolean functions expressing the post 
mutation states of the memory cells in terms of the memory cells" initial values. 

36 A machine implemented method for generating a plurality of subprograms for a 
program to obfuscate the program, the method comprising the steps: 

a) analyzing the program for branch flow; 

b) restructuring and partitioning the program into a plurality of subprograms; 

'""^ c) detemiining a schedule in tem^s of a plurality of memory cells for recovering 
the subprograms in a plaintext fomi for execution, and initial state values for the 
memory cells to store the subprograms in the memory cells in a mutated fom,. except 
for at least, which is stored in one of the memory cells in the plaintext fomi. 

37. The machine as set forth in claim 36. wherein step (a) further includes 
performing peephole randomization on the program. 

38 The method as set forth in claim 36. wherein step (c) includes detennining a 
mutation period requirement for the program, a keylength for the required mutation 
period, the keylength denoting a set's set size, the set being an ordered set of 
pseudo-randomly selected members that will provide the required mutation penod. 

39 The method as set forth in claim 36. wherein step (c) includes selecting a 
memory cell for a generated subprogram to be recovered in the plaintext fomi. and 
detennining a Boolean function for recovering the generated subprogram in the 
plaintext fomi in terms of initial state values of the memory cells used for stonng the 
generated subprograms. 

40 The method as set forth in claim 36. wherein step (c) includes determining 
mutation partners for a plurality of memory cells storing the generated subprograms, 
using a key of an ordered set of pseudo-randomly selected keys, simulating memory 
cell mutations in accordance with the detem)ined mutation partnering, and 
determining a plurality of Boolean functions for the memory cells, the Boolean 
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functions expressing the post mutation states of the memory cells in tenms of the 
memory cells' initial values. 

41 . The method as set forth in claim 36, wherein the method further includes step 
5 (d) inserting a function and a key into each of the generated subprograms, the 

function being used for identifying mutation partners for a plurality of memory cells 
storing the subprograms, for a mutation round, using the key, the key being a member 
of an ordered set of pseudo-randomly selected members that will provide a mutation 
period required by the generated subprograms. 

10 

42. The method as set forth in claim 35, wherein the method further includes step 
(d) inserting a function into each of the generated subprograms for mutating memory 
cells storing the generated subprograms in accordance with computed mutation 
partnerings for a mutation round. 

15 

43. An apparatus comprising: 

an execution unit for executing programming instructions; 
a storage medium having stored therein a first and a second plurality of 
programming instructions to be executed by the execution unit, the first and second 

20 plurality of programming instructions implementing an application with the first 

plurality of programming instmctions implementing a security sensitive function of the 
application and the second plurality of programming instructions implementing a non- 
security sensitive function of the application, the first plurality of programming 
instructions having incorporated a first defensive technique of distributing a secret in 

25 space and in time and/or a second defensive technique of obfuscation to render the 
first plurality of programming instructions virtually unobservable and unmodifiable 
during execution. 

44. The apparatus as set forth in claim 43, wherein the first plurality of 
30 programming instructions incorporated the second defensive technique of 

obfuscation, including one or more unique ordered sets of pseudo-randomiy selected 
members for generating one or more pattems of memory cell mutations, rendering the 
application unique from other copies of the application installed on other apparatus. 

35 45. An apparatus comprising: 

an execution unit for executing programming instructions; 
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a storage medium having stored therein a first, a second, a third, and a fourth, 
plurality of programming instructions to be executed by the execution unit, the first and 
second plurality of programming instructions implementing a first and a second 
integrity verification function for a first and a second application respectively, whereas 

5 the third and fourth programming Instructions implementing a third and a fourth 
integrity verification function for a system integrity verification program, all four 
pluralities of programming instructions having incorporated defensive techniques 
rendering them tamper resistant, the four pluralities of programming instructions jointly 
implementing an interlocking trust mechanism, requiring the first and the second 

10 pluralities of programming instructions each to cooperate with both the third and fourth 
pluralities of programming instructions to complete any integrity verification on the 
apparatus. 

46. A machine implemented method for verifying integrity on an apparatus, the 
15 method comprising the steps of: 

a) a first and a second tamper resistant integrity verification function of a first 
and a second application of the apparatus individually calling a third tamper resistant 
integrity verification function of a system integrity verification program to jointly perfomi 
integrity verification with the first and second tamper resistant integrity verification 

20 functions respectively; 

b) in response, the third tamper resistant integrity verification function calling a 
fourth tamper resistant integrity verification function of the system integrity verification 
program to jointly perform the requested Integrity verifications: 

c) the fourth tamper resistant integrity verification function providing the first and 
25 the second tamper resistant integrity verification functions with respective results of 

the requested integrity verifications. 

47. An apparatus comprising: 

an execution unit for executing programming instructions; 
30 a storage medium having stored therein a first and a second plurality of 

programming instructions to be executed by the execution unit, and a first secret 
private key. the first and second pluralities of programming instructions implementing 
a first and a second tamper resistant decryption function, 

the first tamper resistant decryption function being used for recovering a 
35 first public key asymmetric to the first secret private key, using a second public 
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key. the first public key having been previously encrypted using a second 
secret private key asymmetric to the second public key. 

the second tamper resistant decryption function being used for 
recovering a content encryptton key using the first secret private key the 
content encryption key having been previously encrypted using the first public 



key. 



48 The apparatus as set forth in claim 47. wherein the storage medium further 
having stored therein a third plurality of programming Instructions to be executed by 
10 the execution unit, the third plurality of programming instmctlons implementing a third 
Zr^L function for recovering content using the recovered content encrypfon key. 
the content having been previously encrypted using the content encryption key. 

49. A machine implemented method for recovering content, the method comprising 
15 the steps of: ^ ^^^^^ ^^^^ ^ ^^^^^^ ^^^^^ ^.^^ 

public keys having a first and a second asymmetric private key respectively, the f.rst 
public key having been previously encrypted by the second pnvate key: 

b) providing the recovered first publk: key to be used for encrypting a content 

20 encryption key; 

c) receiving the encrypted content encryption key; and 

d) recovering the content encryption key using the first private key. 



25 50. The method as set forth in claim 47. wherein the method further comprises the 
steps of: 

e) receiving encrypted content; and 

f) recovering content using the recovered content encryption key. 
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